CVE-2020-11467

An issue was discovered in Deskpro before 2019.8.0. This product enables administrators to modify the helpdesk interface by editing /portal/api/style/edit-theme-set/template-sources theme templates, and uses TWIG as its template engine. While direct access to self and self variables was not...

CVE-2020-11467

An issue was discovered in Deskpro before 2019.8.0. This product enables administrators to modify the helpdesk interface by editing /portal/api/style/edit-theme-set/template-sources theme templates, and uses TWIG as its template engine. While direct access to self and self variables was not...

CVE-2020-11467

Deskpro before 2019.8.0 is affected: an attacker can abuse accessible variables in the TWIG-based template context to reach a native unserialize function via the code parameter, allowing remote code execution by crafting a payload in /portal/api/style/edit-theme-set/template-sources. Remediation:...